Here are the steps I configured so far:

General configuration steps

The following steps provide an overview of configuring and testing the hardware used in this example. For best results in this configuration, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results.

  1. Configure the FortiGate unit
    • Configure the external interface
    • Add two VLAN subinterfaces to the internal network interface
    • Add firewall addresses and address ranges for the internal and external networks
    • Add security policies to allow: (this is technically for inter-vlan routing)
    • the VLAN networks to access each other
    • the VLAN networks to access the external network.
  2. Configure the VLAN switch

Also created the trunk on the switch that connects to the LAN interface of the Fortinet, made a switchport access and assigned switchport access VLAN to it. Still not working as designed?

  • Make Sure Fortigate Connect Port VLAN tagged
    – barnabas
    Mar 4, 2018 at 5:27

1 Answer 1


On the FGT this looks OK. However, you don't detail the config on the uplink switch nor its model.

It's essential that you mirror the FGT's VLAN configuration on the switch. An access switchport may not support multiple tagged VLANs - you need to configure a VLAN trunk with (at most) one VLAN untagged (native) and all others tagged.

My personal recommendation for the Fortigate is to run all VLANs tagged - this simplifies later changes and produces clean interface statistics (the physical interface for the untagged VLAN also counts tagged frames).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.